[linux-security] gnorpm bugs

Problem description
===================
While fixing other problems with the gnorpm package, a locally-exploitable
security hole was found where a normal user could trick root running GnoRPM
into writing to arbitrary files due to a bug in the gnorpm tmp file
handling.

A new release of GnoRPM (0.95.1) is now available. This fixes a 
significant number of bugs in the gnorpm package, including this security
hole. Administrators who use this program on multi-user machines should
update it, and anyone who uses it regularly will notice vast improvements.

All versions of GnoRPM before 0.95 are believed to be vulnerable.

Solution
========
RedHat 6.x
rpm -Fvh gnorpm-0.95.1-2.62.i386.rpm

RedHat 7.0
rpm -Fvm gnorpm-0.95.1-3.i386.rpm

Mandrake 6.1, 7.0
rpm -Fvh gnorpm-0.9-5mdk.i586.rpm

Debian, Caldera
not affected.